Blockers to IPv6 Adoption • Hacker News Board

Re: Blockers to IPv6 Adoption

#151

Post by noselasd » Wed, Jun 20, 2018, 8:40 AM UTC

throwaway2048 wrote: post #75

grandinj wrote: post #72

Earlier quoted context omitted.

Not really. Virtually every related protocol (e.g. ARP, BOOTP, OSPF, BGP) was modified in non-trivial ways, the rules around different kinds of addresses (link-local, etc) are very different, IP-level encryption stuff started out mandatory (may not be anymore), various flow-control stuff was tweaked (and tweaked again since then to match the improvements in IPv4), rules for parsing optional header fields was tweaked,…

All of those things would needed to be changed for "IPv4 but longer", its not like you could take the IPv4 versions of any of them and use them.

But then you could change them in trivial ways. This really does make big difference.

Re: Blockers to IPv6 Adoption

#152

Post by beagle3 » Wed, Jun 20, 2018, 2:35 PM UTC

vetinari wrote: post #145

beagle3 wrote: post #108

Earlier quoted context omitted.

Hole punching refers to cooperative nat traversal, that is, with help from the inside - in every discussion I have ever seen. Care to point to 3 examples of common home routers that do not check source IP? I’ve verified many TP-Links, Linksys (when they were owned by Cisco) and Netgears, and all used the kernel to NAT (and yes, they couldn’t do the 1Gb while NATting - usually 300-700 or so. And much lower if you use…

> Hole punching refers to cooperative nat traversal, that is, with help from the inside - in every discussion I have ever seen. If by cooperative you mean that there is outcoming connection on the port, then yes, that's cooperative. If by cooperative you mean some sort of port mapping, whether manual or UPnP, then no, you don't need that. For details, see the paper linked in sibling response.

That paper does not support your assertion that "most NATs do not check the source address and only check the port", in fact, they only consider "endpoints" which are (ip,port) pairs.

Thinking about it, any NAT that ignores the ip part is horribly broken. I still await your examples of routers in actual use that have this behaviour.

Re: Blockers to IPv6 Adoption

#153

Post by beagle3 » Wed, Jun 20, 2018, 2:42 PM UTC

ddalex wrote: post #134

vetinari wrote: post #102

Earlier quoted context omitted.

> That is completely untrue. The vast majority of home routers (I would venture 99% of them) run Linux, and use the built in NAT, which does check source IP, for both TCP and UDP connections Of course it is true. The true thing you wrote is, that Linux is one of the few implementations that do check the source IPs. However, even if many home routers do run Linux, it does not mean that they use Linux's NAT. Many do no…

I really don't know a lot about the hole-punching thing, can you please point me to some docs / demos / code / etc. available that would demonstrate this ? Is there any exploit / known technique / program that allows you to explore a network behind a NAT without cooperation from inside ?

Sort of.

A web page can, in some circumstances, be made to probe - e.g. if you have an " rel="nofollow">http://192.168.1.0"/> it will likely do an http connection to that address; whether you can actually use it for exploration depends on a lot of things.

There's a class of attacks called "DNS rebinding" that use DNS and named hosts to bypass some browser protections and cross-origin policies (see e.g. [0])

But you still need some form of cooperation - a browser request - which, as [0] points out, can be bought as an ad -- just one more reason for ad blockers.

[0] https://medium.com/@brannondorsey/attacking-private-networks...

Re: Blockers to IPv6 Adoption

#154

Post by beagle3 » Wed, Jun 20, 2018, 2:44 PM UTC

vetinari wrote: post #144

ddalex wrote: post #134

Earlier quoted context omitted.

I really don't know a lot about the hole-punching thing, can you please point me to some docs / demos / code / etc. available that would demonstrate this ? Is there any exploit / known technique / program that allows you to explore a network behind a NAT without cooperation from inside ?

The concepts are described here: Ford, Bryan; Srisuresh, Pyda; Kegel, Dan (2005), Peer-to-Peer Communication Across Network Address Translators ( http://www.brynosaurus.com/pub/net/p2pnat/ ) Abstract: Network Address Translation (NAT) causes well-known difficulties for peer-to-peer (P2P) communication, since the peers involved may not be reachable at any globally valid IP address. Several NAT traversal techniques are…

> If you wanted to exploit this, you would have to guess the port, and it would be forwarded to a machine behind the NAT, which "owns" the open port.

Only iff you have static nat forwarding that port, which is almost never. With dynamic NAT (99.99% of setups) no machine "owns" the port before it sends a packet out, and once it does, it only "owns" it with respect to the IP it sent the packets to.